@dzhechkov/keysarium 1.7.7 → 1.7.9

package/templates/.claude/skills/feature-adr/modules/08-qe.md

@@ -23,6 +23,156 @@ sonnet (analytical evaluation)
 
 ## Protocol
 
+## Review convergence gate (Plain and native Workflow)
+
+Review follows **initial review → host rework → focused verification → closure**, or explicit owner
+escalation. A grade/GO label does not establish closure. Run the same installed Node gate before
+planning (phase `ideation`) and before Step-8 completion/delivery (phase `qe`), including resume.
+
+The host prepares a measured artifact snapshot BEFORE independent review. Resolve the executable
+from this installed skill's `scripts/check-review-convergence.mjs`; do not use a scratch replacement.
+For example, from the execution project, using the actual originating role/family:
+
+```bash
+node "$FEATURE_ADR_SKILL/scripts/check-review-convergence.mjs" prepare \
+  --repo "$EXECUTION_PROJECT" --feature "features/$FEATURE_SLUG" --phase ideation \
+  --reviewers '[{"id":"qcsd","family":"owner-exception"}]'
+node "$FEATURE_ADR_SKILL/scripts/check-review-convergence.mjs" evaluate \
+  --repo "$EXECUTION_PROJECT" --feature "features/$FEATURE_SLUG" --phase ideation
+```
+
+The ideation example above is illustrative; QCSD uses its three actual core role entries. For QE use `--phase qe` and the actual `qe-primary` reviewer, plus `qe-precision` when configured.
+`family` is `codex`, `claude`, or an explicitly authorized `owner-exception`. Existing family/routing
+policy remains binding; this receipt does not authorize an exception. Only the host calls `prepare`.
+It retains originating reviewer roles and prior condition meanings in the existing feature checkpoint
+`.fa-state/review-convergence-<phase>-host.json`; neither the latest report nor an empty request array
+can replace that lineage. Do not edit/delete host lineage to obtain a clean bootstrap. A new nonce is
+issued when measured bytes/path membership change; repeated preparation cannot remove conditions. Pending changed paths accumulate across every prepare, including path additions/deletions, until an established closure; failed/refused evaluations never clear them.
+
+The snapshot measures requirements, every direct ADR, architecture, and other available design
+inputs. QE also measures the plan, ideation report, every declared target, and host-discovered Git
+changes/additions/deletions against `.fa-state/base-ref` (HEAD when absent). Receipt/checkpoint files,
+QE report and generated `architecture/map.json` are outputs excluded to avoid circular hashes.
+Explicit planned deletions carry a null digest. Traversal, symlinks and non-files refuse. The host
+must include relevant unchanged dependencies in declared targets; hashing cannot discover semantic
+dependencies. Parallel Workflow design may change after ideation review: that stale review pauses
+before planning and needs focused review of the settled snapshot.
+
+Each independent reviewer writes its OWN entry, preserving other reviewer entries and the actual
+author handoff, in `.fa-state/review-convergence-<phase>-review.json`. A genuinely clean initial
+review needs no invented condition or extra review. Its complete receipt shape is:
+
+```json
+{
+  "schema": "fa-review-convergence-1", "phase": "ideation",
+  "nonce": "<copy host snapshot nonce>", "revision": "<copy host snapshot revision>",
+  "author": null,
+  "reviews": [{
+    "reviewer": "qcsd", "family": "owner-exception", "independent": true, "verdict": "clean",
+    "conditions": [], "verifications": [],
+    "newRisks": {"assessment": "none identified after complete scope review", "evidence": "<actual review evidence>", "conditions": []},
+    "authorAssessmentChecked": false, "deltaVerification": null
+  }]
+}
+```
+
+`verdict` is `clean`, `conditional`, or `no-go`. Conditions have closed fields
+`{id, owner, severity, classification, requirement, scope, evidence}`: stable unique ID, originating
+role ID, BLOCKER/CRITICAL/HIGH/WARNING/SUGGESTION, structural/wording, exact acceptance meaning,
+nonempty repo-relative scope paths, and original evidence. Carry every prior own condition unchanged
+on every pass. Reviewer verifications have closed fields
+`{id, revision, classification, evidence, implementationVerified}`. Only the originating independent
+role can verify its own condition at the current revision; author/lead/scribe assertions cannot.
+
+Rework requires the actual author object
+`{addressed, changedScope, classification, delta, evidence, newRisks}`. Addressed IDs name prior
+conditions; changedScope includes ALL host-measured changes and affected dependencies. Delta/evidence
+explain the actual fix. Both author and reviewer `newRisks` require explicit assessment/evidence and a
+conditions array, including an explicit none-identified assessment when empty. The reviewer must set
+`authorAssessmentChecked:true` and supply independent
+`deltaVerification:{classification,evidence,implementationVerified}`. Structural changes affect
+behavior, contracts, safeguards, architecture or acceptance meaning and require affected implementation
+and test verification. Wording changes affect expression only; the independent reviewer checks that
+classification, so an author's wording label cannot weaken structural verification.
+
+Focused scope is outstanding conditions plus actual changes and affected dependencies. New serious
+risks always expand that scope. Retain ALL conditions and serious primary/precision findings until
+own-reviewer verification; a token/round ceiling escalates unresolved risk, never approves it.
+
+Gate exits: 0 with `prepared` (prepare only) or `closed` (evaluate only); 1 `unresolved`; 3
+`not-established`. Inspect the structured reasons/unresolved IDs. Missing executable/report, malformed
+or contradictory output, foreign/duplicate/omitted conditions, stale phase/nonce/manifest or unavailable
+reviewer refuses. Native Workflow strictly checks stdout AND exit before planning and before
+completion/delivery/success tags. Supported native/Mode-B/fallback/precision reviewers receive this
+contract; the read-only Codex mode-A route cannot accept it and pauses for a supported independent
+review. A scribe never creates reviewer evidence from grade. Historical resume without this contract
+needs fresh evidence; resume rechecks bytes and every configured route, including unwitnessed precision.
+
+Host prepare first reads the existing reviewer receipt, including valid partial own entries written
+before an agent/transport failure. It preserves independently written conditions under their original
+role/family before binding any actual fallback. This imports findings, never closure or author/scribe
+claims. A stale receipt cannot originate new host conditions; known prior meanings remain immutable.
+`pending-reviewer-receipt-needs-origin-review` pauses before native fallback dispatch when pending
+evidence cannot be reconciled. Keep the original receipt and host lineage. Have its originating
+reviewer repair malformed/foreign fields or refresh unknown stale own findings at the unchanged
+host identity/current snapshot. Repeat prepare for the selected actual base-role families, complete
+the returned full reviewer roster with actual own verification, then evaluate and resume the same
+slug. No receipt/lineage deletion or relabeling is a recovery action. The existing QE checkpoint
+validator rejects a paused non-QE result, so same-slug resume re-enters only that reviewer stage;
+unrelated coder checkpoints remain eligible for reuse.
+
+Bind the actual fallback family with host prepare BEFORE reviewer dispatch. An unused role may change family; once review evidence originated, its role/family and prior conditions remain required, and the new family receives a distinct `<base-id>:<family>` role. Reviewers read the returned full roster and never relabel old ownership.
+
+On refusal, the host settles artifacts, calls prepare with the selected actual base-role families, supplies
+the author handoff, requests focused own-condition verification, then evaluates and resumes the same
+slug. This is host-driven repair, not an automatic repair loop. Existing Confirmation, amendment,
+scope, testing, independent-family and budget gates remain conjunctive. This gate establishes receipt
+consistency and current artifact binding, not semantic truth or authenticated reviewer identity.
+
+For a same-slug QE resume blocked by historical serious findings, read-only mode A, or an
+unwitnessed precision append, preserve the complete original checkpoint, findings and grades.
+Prepare returns `checkpointDigest`: SHA-256 of `JSON.stringify` of the latest `qe` result in
+`.fa-state/checkpoints.jsonl`. Each actual originating reviewer supplies optional closed-field
+`checkpointVerification:{checkpointDigest,evidence,supported:true,route,findings,reportDigest}`
+in its own review entry, in addition to the ordinary current-revision independent verification.
+`route` is native/mode-b/fallback and evidence describes the actual supported focused review;
+mode A, author/scribe flags, or the old grade cannot establish this proof. `findings` maps EVERY
+original serious gap with `{digest,conditionId}`, where digest is SHA-256(JSON.stringify(gap))
+and conditionId names that reviewer's preserved serious condition with its current structural
+implementation verification. Both primary and precision origins must verify their own findings.
+Use `reportDigest:null` normally; an unwitnessed precision append requires that originating
+precision reviewer to verify the actual complete `08_qe_report.md` and supply its SHA-256.
+The report must contain Primary QE pass, Precision QE pass, and Combined Step-8 grade sections.
+Then evaluate with the same phase/repo/feature and re-invoke the same slug. Only a closed gate
+with complete checkpoint binding can reconcile historical refusals on an actual resumed QE stage;
+live findings, changed checkpoints/artifacts and a failed Confirmation gate still block delivery.
+This procedure runs no coder or automatic repair loop, and retains the historical result for audit.
+
+
+### Bridge identity for plain Step 8
+
+When the plain host invokes the existing Claude review bridge, take round number, pipeline run and
+task from the current round receipt/state in the execution project. Pass the fields actually present:
+
+```bash
+dz qe-bridge --family claude --slug "$FEATURE_SLUG" --project "$EXECUTION_PROJECT" \
+  --round "$CURRENT_ROUND" --round-run "$CURRENT_ROUND_RUN" --task "$CURRENT_TASK" \
+  --coder-family codex
+```
+
+Do not mint missing identifiers or point `--project` at a separate learning brain. Explicit identity
+must agree with one readable open round before any probe or review child; conflicts refuse with exit 2.
+The bridge freezes that snapshot for the signoff. Signoff `roundRun` is the pipeline run; its existing
+`runId` identifies the separate bridge invocation and audit filenames. No-flags standalone reviews
+retain best-effort lookup and visibly unbound provenance when authority is absent or unavailable.
+
+Round close validates every present identity field before selection. Full, partial and genuinely
+identity-free window assurance appear as `round-run-task`, `partial-identity` and `legacy-window`.
+Malformed or foreign claims cannot become a manual-close fallback. This contract governs the
+existing plain bridge and control-review caller; native Workflow QE already runs its own review and
+must not invoke a second bridge to manufacture this receipt. Local fake-child tests do not establish
+a live Claude model roundtrip or secure every native Codex QE receipt.
+
 ### 1. Smoke Tests (All tiers)
 
 ```
@@ -32,7 +182,7 @@ sonnet (analytical evaluation)
 - [ ] Type checker passes (if configured)
 ```
 
-For S-tier: if all pass, proceed to checkpoint. Done.
+For S-tier: passing smoke tests still requires the review-convergence contract above before checkpoint/completion; a smoke pass alone is not closure.
 
 ### 2. Test Generation (M+)
 
@@ -205,7 +355,9 @@ list), grep for unfinished-stub markers: `TODO` / `FIXME` / `HACK` / `XXX` / `PL
 file:line, UNLESS the line carries an inline `no-stubs: <reason>` waiver WITH a non-empty reason, or
 `.dz/guard.json` `stubWaivers` lists the path WITH a reason. A REASONLESS waiver is itself a HIGH gap,
 never an exemption. Cross-check mechanically: `dz guard check --op publish --json` runs the same scan
-as the SOFT `no-stubs` rule over the working-tree diff. When you QUOTE a marker in `08_qe_report.md`,
+as the SOFT `no-stubs` rule over the working-tree diff.
+After the Step-7 code has landed, run `dz guard check --op code --json` and treat a HARD `block` verdict
+as a HIGH finding naming the drifted file. When you QUOTE a marker in `08_qe_report.md`,
 backtick it so the report itself scans clean (the claim-check forbidden-phrase convention). Record the
 verdict in the ADR Fitness section.
 
@@ -311,6 +463,9 @@ Compile all findings into a structured report:
 ✅ READY FOR MERGE | ❌ NEEDS FIXES | ⚠️ CONDITIONAL APPROVAL
 ```
 
+Settle a cross-family re-QE debt with `dz reqe --slug <s> --done --report <08b>`.
+For `dz reqe --done`, exit 3 means the review settled but named BLOCKER/HIGH findings — stop and surface them to the owner.
+
 ### 7.1 Findings ledger (machine-readable)
 
 Prose is for people; `dz score`/`dz recap` need a machine-readable surface too (qe-findings-record,
@@ -373,9 +528,13 @@ resume guard at all before this).
 Otherwise — QE ran fresh in this pass — after `08_qe_report.md` is written and the grade is final, run:
 
 ```bash
-dz feature-adr-record --kind ledger --stage qe --slug <slug> --row '<json>' --auto --json
+dz feature-adr-record --kind ledger --stage qe --slug <slug> --row '<json>' --json
 ```
 
+fix-round-1 (Codex r1 HIGH finding 4, ADR-001 D5): no `--auto` here. `--auto` is the trusted marker
+of an AUTOMATED pipeline run and requires an experiment envelope that the manual path does not have;
+this plain-mode row is written without it.
+
 `<json>` carries the same fields the ultracode pipeline writes for this row: `reviewer` (the model
 that reviewed, or `null` if unknown — never guessed), `reviewerFamily` (`claude`|`codex`|`null` when
 the reviewer identity is not one of the two known families — never guessed as `claude`), `qeRole`

package/templates/.claude/skills/feature-adr/scripts/build-coder-context.mjs

@@ -0,0 +1,201 @@
+#!/usr/bin/env node
+// One parser for workflow and plain Step 7. Importing this module performs no IO.
+import { createHash } from 'node:crypto';
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, readdirSync, realpathSync } from 'node:fs';
+import { isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const SCHEMA = 'fa-coder-context-1';
+const MAX_DOCUMENTS = 64;
+const MAX_FILE_BYTES = 256 * 1024;
+const MAX_TOTAL_BYTES = 1024 * 1024;
+const MAX_PROMPT_BYTES = 96 * 1024;
+const sha = (text) => createHash('sha256').update(text, 'utf8').digest('hex');
+const kindOf = (path) => path === '01_requirements.md' ? 'requirements'
+  : path === '06_implementation_plan.md' ? 'plan'
+    : /^03_adr\/[0-9]{3}-[^/\\\x00-\x1f]+\.md$/.test(path) ? 'adr' : null;
+const diagnostic = (source, reason, section) => ({ source, reason, severity: 'error', ...(section ? { section } : {}) });
+
+// One lexical pass recognizes comments only outside Markdown code/escapes, retaining offsets.
+function markdown(text) {
+  const headings = [];
+  const visible = [];
+  let fence = null;
+  let comment = false;
+  let inlineEnd = -1;
+  let offset = 0;
+  for (const line of text.match(/[^\n]*\n|[^\n]+$/g) ?? []) {
+    const clean = line.replace(/\r?\n$/, '').replace(/^\uFEFF/, '');
+    const delimiter = /^ {0,3}(`{3,}|~{3,})(.*)$/.exec(clean);
+    if (fence) {
+      if (delimiter && delimiter[1][0] === fence.char && delimiter[1].length >= fence.length && delimiter[2].trim() === '') fence = null;
+      else visible.push(line);
+    } else if (!comment && inlineEnd <= offset && delimiter && !(delimiter[1][0] === '`' && delimiter[2].includes('`'))) {
+      fence = { char: delimiter[1][0], length: delimiter[1].length };
+    } else {
+      const wasComment = comment;
+      let masked = '';
+      for (let i = 0; i < line.length;) {
+        if (comment) {
+          if (line.startsWith('-->', i)) { masked += '   '; i += 3; comment = false; }
+          else { masked += /[\r\n]/.test(line[i]) ? line[i] : ' '; i++; }
+          continue;
+        }
+        if (offset + i < inlineEnd) { masked += line[i++]; continue; }
+        // An escaped '<' cannot start a comment; paired backslashes still allow the next opener.
+        if (line[i] === '\\' && i + 1 < line.length && /[!"#$%&'()*+,\-./:;<=>?@[\]\\^_`{|}~]/.test(line[i + 1])) {
+          masked += line.slice(i, i + 2); i += 2; continue;
+        }
+        if (line[i] === '`') {
+          const run = /^`+/.exec(line.slice(i))[0];
+          const rest = text.slice(offset + i + run.length);
+          // Code spans can wrap within a paragraph, but cannot hide a subsequent block heading/fence.
+          const boundary = /\n[ \t]*(?:\r?\n|#{1,6}[ \t]|`{3,}|~{3,})/.exec(rest);
+          const paragraph = boundary ? rest.slice(0, boundary.index) : rest;
+          const close = [...paragraph.matchAll(/`+/g)].find((match) => match[0].length === run.length);
+          if (close) inlineEnd = offset + i + run.length + close.index + run.length;
+          masked += run; i += run.length; continue;
+        }
+        if (line.startsWith('<!--', i)) { comment = true; masked += '    '; i += 4; continue; }
+        masked += line[i++];
+      }
+      const heading = !wasComment && /^ {0,3}(#{1,6})[ \t]+(.+?)\s*$/.exec(masked.replace(/\r?\n$/, '').replace(/^\uFEFF/, ''));
+      if (heading) headings.push({ depth: heading[1].length, title: heading[2].replace(/[ \t]+#+[ \t]*$/, '').trim(), start: offset, body: offset + line.length });
+      else visible.push(masked);
+    }
+    offset += line.length;
+  }
+  return { headings, unclosed: fence !== null, unclosedComment: comment, substantive: visible.join('').trim() !== '' };
+}
+
+/** Pure: consumes already-read documents only, and hashes the same snapshot used for the block. */
+export function buildCoderContext({ tier, documents }) {
+  const diagnostics = [];
+  const sources = [];
+  const blocks = [];
+  let bounded = true;
+  if (!['S', 'M', 'L', 'XL'].includes(tier)) diagnostics.push(diagnostic('tier', 'invalid-tier'));
+  if (!Array.isArray(documents)) documents = [];
+  if (documents.length > MAX_DOCUMENTS) { diagnostics.push(diagnostic('documents', 'document-limit')); bounded = false; }
+  const sorted = [...documents].sort((a, b) => String(a?.path).localeCompare(String(b?.path), 'en'));
+  const seen = new Set();
+  let total = 0;
+  for (const doc of sorted.slice(0, MAX_DOCUMENTS)) {
+    const path = doc?.path;
+    const kind = typeof path === 'string' && path.length <= 512 ? kindOf(path) : null;
+    if (!kind || typeof doc.text !== 'string') { diagnostics.push(diagnostic(String(path ?? 'documents'), 'invalid-source')); bounded = false; continue; }
+    if (seen.has(path)) { diagnostics.push(diagnostic(path, 'duplicate-source')); bounded = false; continue; }
+    seen.add(path);
+    const bytes = Buffer.byteLength(doc.text, 'utf8'); total += bytes;
+    const status = bytes > MAX_FILE_BYTES ? 'oversized' : 'read';
+    sources.push({ path, kind, bytes, digest: status === 'read' ? sha(doc.text) : null, status });
+    if (status !== 'read') { diagnostics.push(diagnostic(path, 'file-limit')); bounded = false; continue; }
+    const parsed = markdown(doc.text);
+    if (parsed.unclosed) diagnostics.push(diagnostic(path, 'unclosed-fence'));
+    if (parsed.unclosedComment) diagnostics.push(diagnostic(path, 'unclosed-comment'));
+    if (kind !== 'adr') {
+      if (!parsed.substantive) diagnostics.push(diagnostic(path, 'empty-section', 'body'));
+      blocks.push('\n\n### Source: ' + path + ' — body\n' + doc.text);
+      continue;
+    }
+    for (const section of ['Decision', 'Confirmation']) {
+      const matches = parsed.headings.filter((h) => h.depth >= 2 && h.title.toLowerCase() === section.toLowerCase());
+      if (matches.length !== 1) { diagnostics.push(diagnostic(path, matches.length ? 'duplicate-section' : 'missing-section', section)); continue; }
+      const heading = matches[0];
+      const next = parsed.headings.find((h) => h.start > heading.start && h.depth <= heading.depth);
+      const body = doc.text.slice(heading.body, next ? next.start : doc.text.length);
+      if (!markdown(body).substantive) diagnostics.push(diagnostic(path, 'empty-section', section));
+      blocks.push('\n\n### Source: ' + path + ' — ' + section + '\n' + body);
+    }
+  }
+  if (total > MAX_TOTAL_BYTES) { diagnostics.push(diagnostic('documents', 'aggregate-limit')); bounded = false; }
+  for (const path of ['01_requirements.md', '06_implementation_plan.md']) {
+    if (!seen.has(path)) {
+      sources.push({ path, kind: kindOf(path), bytes: 0, digest: null, status: 'missing' });
+      diagnostics.push(diagnostic(path, 'missing-source'));
+    }
+  }
+  if (tier !== 'S' && !sources.some((s) => s.kind === 'adr')) diagnostics.push(diagnostic('03_adr', 'missing-source'));
+  let promptBlock = '\n\n## Current coder context (literal source snapshot)' + blocks.join('');
+  if (tier === 'S' && !sources.some((s) => s.kind === 'adr')) promptBlock += '\n\nADR sources: none selected (tier S).';
+  if (Buffer.byteLength(promptBlock, 'utf8') > MAX_PROMPT_BYTES) {
+    diagnostics.push(diagnostic('promptBlock', 'prompt-limit')); promptBlock = '';
+  }
+  return { schema: SCHEMA, status: diagnostics.length ? 'incomplete' : 'complete', promptBlock,
+    digest: bounded ? sha(JSON.stringify([SCHEMA, tier, sorted.map((d) => [d.path, d.text])])) : null,
+    sources: sources.sort((a, b) => a.path.localeCompare(b.path, 'en')), diagnostics };
+}
+
+function hostContext(feature, tier) {
+  const failures = [];
+  const documents = [];
+  const failedSources = [];
+  let root;
+  const fail = (path, reason, status = 'unreadable', bytes = 0) => {
+    failures.push(diagnostic(path, reason));
+    failedSources.push({ path, kind: kindOf(path) ?? 'adr', bytes, digest: null, status });
+  };
+  try {
+    if (lstatSync(feature).isSymbolicLink() || !lstatSync(feature).isDirectory()) throw new Error('invalid-root');
+    root = realpathSync(feature);
+  } catch { return { schema: SCHEMA, status: 'unavailable', promptBlock: '', digest: null, sources: [], diagnostics: [diagnostic(feature, 'invalid-root')] }; }
+  let paths = ['01_requirements.md', '06_implementation_plan.md'];
+  const adrDir = join(root, '03_adr');
+  try {
+    const stat = lstatSync(adrDir);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) fail('03_adr', 'invalid-file', 'invalid');
+    else paths.push(...readdirSync(adrDir).filter((name) => /^[0-9]{3}-.+\.md$/.test(name)).sort().map((name) => '03_adr/' + name));
+  } catch (error) { if (error.code !== 'ENOENT') fail('03_adr', 'read-failure'); }
+  if (paths.length > MAX_DOCUMENTS) return { schema: SCHEMA, status: 'incomplete', promptBlock: '', digest: null, sources: [], diagnostics: [diagnostic('documents', 'document-limit')] };
+  let total = 0;
+  for (const path of paths) {
+    let fd;
+    try {
+      const file = join(root, path);
+      const stat = lstatSync(file);
+      if (stat.isSymbolicLink() || !stat.isFile()) { fail(path, 'invalid-file', 'invalid'); continue; }
+      const actual = realpathSync(file);
+      const rel = relative(root, actual);
+      if (rel === '..' || rel.startsWith('..' + sep) || isAbsolute(rel)) { fail(path, 'outside-root', 'invalid'); continue; }
+      fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+      const opened = fstatSync(fd);
+      // Compare the opened descriptor with the contained file checked before open.
+      if (!opened.isFile() || opened.ino !== stat.ino || opened.dev !== stat.dev || realpathSync(file) !== actual) { fail(path, 'invalid-file', 'invalid'); continue; }
+      const chunks = []; let bytes = 0;
+      while (true) {
+        const chunk = Buffer.alloc(Math.min(16384, MAX_FILE_BYTES + 1 - bytes));
+        const count = readSync(fd, chunk, 0, chunk.length, null);
+        if (count === 0) break;
+        bytes += count; total += count; chunks.push(chunk.subarray(0, count));
+        if (bytes > MAX_FILE_BYTES || total > MAX_TOTAL_BYTES) break;
+      }
+      if (bytes > MAX_FILE_BYTES) { fail(path, 'file-limit', 'oversized', bytes); continue; }
+      if (total > MAX_TOTAL_BYTES) { fail(path, 'aggregate-limit', 'oversized', bytes); break; }
+      try { documents.push({ path, text: new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(Buffer.concat(chunks)) }); }
+      catch { fail(path, 'invalid-utf8', 'invalid', bytes); }
+    } catch (error) { fail(path, error.code === 'ENOENT' ? 'missing-source' : 'read-failure', error.code === 'ENOENT' ? 'missing' : 'unreadable'); }
+    finally { if (fd !== undefined) closeSync(fd); }
+  }
+  const result = buildCoderContext({ tier, documents });
+  if (failures.length) {
+    const failed = new Set(failedSources.map((s) => s.path));
+    result.sources = result.sources.filter((s) => !failed.has(s.path)).concat(failedSources).sort((a, b) => a.path.localeCompare(b.path, 'en'));
+    result.diagnostics = result.diagnostics.filter((d) => !(failed.has(d.source) && d.reason === 'missing-source')).concat(failures);
+    result.status = failures.every((d) => ['file-limit', 'aggregate-limit'].includes(d.reason)) ? 'incomplete' : 'unavailable';
+    result.digest = null;
+  }
+  return result;
+}
+
+function main(argv) {
+  const feature = argv[0];
+  const tier = argv.find((arg) => arg.startsWith('--tier='))?.slice(7);
+  let result;
+  if (!feature || !['S', 'M', 'L', 'XL'].includes(tier) || argv.some((arg, i) => i > 0 && arg !== '--tier=' + tier)) {
+    result = { schema: SCHEMA, status: 'unavailable', promptBlock: '', digest: null, sources: [], diagnostics: [diagnostic('arguments', 'invalid-arguments')] };
+  } else result = hostContext(resolve(feature), tier);
+  console.log(JSON.stringify(result));
+  return result.status === 'complete' ? 0 : 1;
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1])) process.exitCode = main(process.argv.slice(2));